---

Overview

In June 2023, a vulnerability was discovered and published as CVE-2023-33998, affecting the popular WordPress plugin Easy Social Icons (versions up to 3.2.5). This flaw, known as a *Missing Authorization* vulnerability, stems from poor access control settings. Due to this, even unauthenticated users could make sensitive changes on websites using the plugin.

In this long read, we'll break down what this vulnerability is, demonstrate exploitation with real code snippets, and share references where you can learn more. Let’s dig in!

What is Easy Social Icons?

Easy Social Icons is a widely-used tool for adding social media icons to a WordPress website. Its wide usage makes any security issue potentially dangerous for many sites.

CVE-2023-33998 – The Core Issue

CVE-2023-33998 is all about *missing authorization*. Some crucial admin functions in the plugin failed to check if a user was allowed to perform them. Think of this like a store that forgets to check if you’re an employee before letting you behind the register.

Affected Versions

Any version up to and including 3.2.5 is affected. If you’re running a newer version, you’re probably safe – but always double-check your plugin updates!

How Was It Discovered?

The issue was documented by security researchers and eventually published on sites like WPScan and CVE.org.

Exploit Details: How Attackers Take Advantage

The vulnerability arises from the plugin’s admin AJAX handling code. Specifically, it registers several AJAX actions without verifying the requesting user’s role or capability.

Example Code: Where Things Went Wrong

// This snippet registers an AJAX action without authentication
add_action('wp_ajax_update_social_icons', 'easy_social_icons_update_callback');
add_action('wp_ajax_nopriv_update_social_icons', 'easy_social_icons_update_callback');

function easy_social_icons_update_callback() {
    // ... Plugin updates the social icons here
}

Notice wp_ajax_nopriv_update_social_icons — this allows non-logged-in users to access the function!

An attacker can send a simple HTTP POST request, no login or credentials needed

curl -X POST "https://victim-site.com/wp-admin/admin-ajax.php"; \
  -d "action=update_social_icons&icon_url=https://malicious-site.com/evil-icon.png";

*Result:* The attacker changes the social icon to display any image/link they want, possibly redirecting users or running further phishing schemes.

Fix Status

Fixed in version 3.2.6 and above!
If you're using an older version, update the plugin from the WordPress repository ASAP.

Check if your plugin version is <= 3.2.5.

- Scan site logs for suspicious POST requests to /wp-admin/admin-ajax.php with the action=update_social_icons.
- Use WordPress security plugins like Wordfence or WPScan to audit your plugins.

Original advisory credits go to the security researchers who found and responsibly disclosed the bug

- WPScan vulnerability report
- CVE record

Final Thoughts

CVE-2023-33998 is a textbook case of what can happen when access controls aren’t properly handled in plugin code. If you manage WordPress sites, keep everything up-to-date and audit your plugins regularly.

Further Reading

- Easy Social Icons Plugin Official Page
- WPScan Advisory
- NVD Entry for CVE-2023-33998

Timeline

Published on: 12/13/2024 15:15:14 UTC